olafhartong/sysmon-cheatsheet olafhartong/sysmon-cheatsheet

  • Stars
    star
    507
  • Rank 87,068 (Top 2 %)
  • Language
  • License
    MIT License
  • Created over 5 years ago
  • Updated about 3 years ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
olafhartong/sysmon-cheatsheet
github

olafhartong

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

All sysmon event types and their fields explained

sysmon-cheatsheet

All sysmon event types and their fields explained

Sysmon-graph.png

More Repositories

1

sysmon-modular

A repository of sysmon configuration modules
PowerShell
2,381
star
2

ThreatHunting

A Splunk app mapped to MITRE ATT&CK to guide your threat hunts
1,090
star
3

ATTACKdatamap

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
PowerShell
342
star
4

MDE-AuditCheck

MDE relies on some of the Audit settings to be enabled
PowerShell
92
star
5

Presentations

My conference presentations
63
star
6

detection-sources

51
star
7

DefenderHarvester

Expose a lot of MDE telemetry that is not easily accessible in any searchable form
Go
48
star
8

TA-Sysmon-deploy

Deploy and maintain Symon through the Splunk Deployment Sever
Batchfile
31
star
9

WDACme

A WDAC configuration repository with the sole intention of enriching MDE
20
star
10

parsoalto

Palo Alto Networks Rule Parser
PHP
16
star
11

Sentinel-template-parser

Azure Sentinel Template parser
PowerShell
15
star
12

SA-Threat-Hunting

Splunk app for Threat hunting
13
star
13

sysmon-modular-linux

A repository of Sysmon For Linux configuration modules
12
star
14

sysmon-parser

Automatically generated Sysmon parser for Azure Sentinel
PowerShell
10
star
15

unfetter-discover

Unfetter-Discover Vagrant script for the Unfetter-Discover docker release
Shell
8
star
16

scripts

just random simple scripts
Shell
5
star
17

disposable-windows

A packer project to quickly have a test / dev / IR box
2
star
18

olafhartong

2
star
19

Clear-dminline

After migrating a Cisco ASA config to a Palo Alto config you remain with all these horrible DMINLINE objects, this tool resolves all members and replaces the ogroup object by its members
Python
2
star
20

BHCEupload

A small go tool to upload JSON files to the BloodHound community edition API
Go
1
star